fix: parse space-separated allowed-tools strings (fixes #327)

[Bimpebabs]

Fixes #327

What

Fixes the allowed-tools parsing bug where space-separated tool names were treated as a single tool, causing false positives on fully-declared skills.

Why

The current parsing splits on commas but not whitespace. A declaration like allowed-tools: Bash Read is parsed as a single tool named Bash Read, which never matches any actual tool name. This causes the LP1 check to fire on skills that have correctly declared their tools.

How

• build_context.py: split the allowed-tools string on whitespace (spaces, tabs, newlines) when no comma is present. Comma-separated strings continue to work as before.
• mcp_least_privilege.py: same fix in _normalize_allowed_tools for consistency.
• Added test cases for: space-separated, mixed whitespace, single-tool space-separated, and the existing comma-separated and list forms.

Testing

• Added 4 new test cases covering the parsing variations
• All 41 existing tests pass (38 pass, 2 skipped, 1 pre-existing Windows-specific failure unrelated to this change)
• Manual verification with a test skill file

Manual verification

Tested on: Windows 11, Python 3.14

Steps:

1. Created a test skill with allowed-tools: Bash Read (space-separated)
2. Ran skillspector scan on the test skill
3. Confirmed LP1 does not fire for the declared tools
4. Ran the same test with allowed-tools: Bash, Read (comma-separated) — backward compat confirmed
5. Ran with allowed-tools: [Bash, Read] (list form) — backward compat confirmed

Result: PASS — space-separated parsed correctly, LP1 false positive eliminated, backward compatibility maintained.